Forge

Overview

Forge is a terminal-based autonomous AI coding agent that runs locally on the operator's machine. It connects to any OpenAI-compatible endpoint, to Anthropic via direct API key, to ChatGPT Codex via OAuth against an existing ChatGPT Plus subscription, or to local model servers such as LM Studio, Ollama, llama.cpp, and vLLM. No mandatory cloud, no telemetry. Claude subscription (Pro/Max) login is not supported — Anthropic's terms restrict subscription OAuth credentials to its own applications. Use an Anthropic API key instead.

The agent is built around a small Rust core and a terminal UI, and is designed to be readable and tailorable rather than feature-maximal. The codebase is intentionally small enough that an operator can read it, understand what the agent is doing, and modify it when their workflow demands something a vendor wouldn't ship.

A standalone graphical IDE built on the same Rust agent core ships alongside the terminal client as a second surface, distributed as a signed and notarized .dmg for Apple Silicon on macOS 13 or later. That build is arm64 only — an Intel Mac will not run it, and Intel is not a current target. Windows and Linux both run natively as of 0.5.2, installed by a script that builds from a checkout rather than by a packaged binary: install.ps1 on x64 Windows, and on Linux an installer for x86-64 verified against a fresh Ubuntu system. Both installers refuse to run on ARM64 outright rather than attempting a build that has not been validated, so arm64 is a supported architecture on macOS and on neither of the others. Each platform has its own document stating what is verified and what is not — WINDOWS.md and LINUX.md. The known gaps on Windows are real: an editor terminal does not survive a process restart, because the daemon that keeps one alive still speaks over a Unix socket, and the browser handoff remains macOS-only. Windows is gated in CI for the agent, the protocol, the search engine and the terminal client, but the editor itself is not built there, so a regression in the editor on Windows would not be caught automatically. The CLI and the GUI run against the same agent and can be used independently — the GUI isn't a replacement for the terminal experience, and the terminal isn't a fallback for the GUI.

Capabilities

• Tool surface

  File read and write, unified-diff patching, code search, glob, shell execution through a streaming PTY path, web search and fetch, structured user questions, and a custom shell-backed tool interface that loads from ~/.config/forge/tools/ or project-local .agent/tools/.

• Parallel subagents

  Bounded subagent delegation with independent context windows, per-agent tool allowlists, configurable concurrency and depth, and rolling-window fallback on context overflow.

• Planning mode

  Plans are drafted, reviewed, and approved before any write or execute action runs.

• Context management

  Two strategies: model-backed structured compaction, or rolling window with configurable thresholds. Both are validated against long-running sessions and stay coherent across multi-file work.

• Session persistence and revert

  Sessions are logged to .forge/sessions/{id}/conversation.jsonl and can be resumed. Revert is Git-backed: workspace state is snapshotted at turn boundaries and can be restored together with conversation history.

• Safety model

  Approval-based command gating, not host isolation. Forge is a sharp tool: once a tool is approved or auto-approval is enabled, it runs with the same access as the user account that launched it. The project root is the default working directory, not a sandbox. This boundary is documented in the architecture notes.

Project log

• September 29, 2026

  Forge 0.6.0 released — the crawler can prove who it is

  Requests from Forge's crawler can now be signed. Web Bot Auth — Ed25519 over the request authority, per draft-meunier-webbotauth-httpsig-protocol on top of RFC 9421 HTTP Message Signatures — with the public half published at a well-known path on a domain the operator controls. An honest user agent is a claim anyone can make; a signature is the same claim made checkable. Off unless configured, and a key set without a published directory is refused rather than used, because a signature nobody can look up reads as a failed forgery rather than an honest unsigned request.

  This release also carries the results of an adversarial audit of the crawler, commissioned against itself. Four security issues, each with its affected versions computed from the tags rather than estimated: a crawl could be pointed at the machine Forge was running on, including loopback and cloud metadata addresses; a cross-origin redirect bypassed robots.txt, host containment and per-host politeness; a signature could arrive at a host it was not made for; and Forge could describe a page as one a person had opened in a browser when nobody had. The full disclosure, including which first attempts were incomplete and what review caught, is in the release notes.

  Dependency count fell from 677 packages to 650. The scraper crate is gone — used in one file for five selectors, four of which were better served by the HTML parser this project already wrote — taking 27 packages and three of the five MPL-2.0 licensed crates out of the tree with it. A re-crawl now asks whether a page changed rather than asking for it again, and returns only the validator that identifies nobody: Last-Modified describes content, while an ETag can be minted per visitor, so the second is behind an option that defaults to off. Signed build attached to the release. See the 0.6.0 release notes.

• September 27, 2026

  Forge 0.5.2 released — Windows and Linux run natively

  Both the editor and the terminal client now build and run on Windows. The terminal client had not compiled there at all: its sys.rs was #![cfg(unix)] in its entirety, and it has a console-API implementation now for raw mode, key reading, terminal size and resize. The editor gained a ConPTY terminal, reworked text and artwork rendering, live font-size changes, and an installer that places both interfaces with optional shortcuts and a generated icon. Linux has an installer verified against a fresh Ubuntu system, with WSL and other distributions documented. Both installers are x64 / x86-64 and refuse ARM64 outright rather than attempting a build nobody has validated, so arm64 remains a supported architecture on macOS and on neither of the others.

  What these are not is packaged binaries. Each is a source installer that builds from a checkout, and WINDOWS.md says so in those words, along with what is not yet true: an editor terminal on Windows does not survive a process restart, because the daemon that keeps one alive still speaks over a Unix socket; remote helpers are not bundled by the installer; and the browser handoff remains macOS-only. Windows is not yet gated in CI either — its job there is informational and cannot fail the build — so a regression on it would not be caught automatically. macOS on Apple Silicon stays the only platform with a signed, notarized download.

  Alongside that: a message sent while the agent was talking could be dropped silently. The headless protocol read stdin with read_line inside a select!, which is not cancellation-safe — an outgoing event arriving mid-line discarded the read and the bytes already consumed, so the client waited for a reply to something the agent never saw, and the more the agent had to say the likelier it became. A dropped SSH connection could also quietly move remote work onto the local machine; the editor now tracks the disconnection and a failed reconnect cannot silently fall back to local. For ChatGPT Codex, the only provider that reports one, both interfaces now show how much of the weekly allowance is left and when it resets. See the 0.5.2 release notes.

• September 25, 2026

  Forge 0.5.1 released

  A credential the operator never supplied is no longer created on their behalf. Signing in with a ChatGPT subscription exchanged the OAuth token for an sk- API key, wrote it to chatgpt_auth.json, and then preferred it over the token it came from — so a request failed naming a key the operator had never issued and could not find in any config. Nothing mints one now, and a key left by an older build is dropped when the file loads, so it leaves disk on the next save. Because it was a preference rather than a missing branch, it worked whenever the mint failed and broke whenever it succeeded, which is why signing in again never helped.

  Both outbound user agents now carry a contact URL — forge-search/<version> and forge-agent/<version>, each followed by a link to this page — so an operator who finds unfamiliar traffic in their logs can identify what it is rather than only block it. The repository README gained a section addressed to that reader: what Forge is, and how to object. A test refuses any spoofed browser string returning to either agent. The editor also answers --version and --help without opening a window first, and an approved plan no longer leaves the agent with nothing it is permitted to do.

  Groundwork for other platforms landed alongside — CI now exercises forge-search and measures a Windows build — but this release does not add Windows or Linux support, and the packaged build remains Apple Silicon only. Signed build attached to the release. See the 0.5.1 release notes.

• September 23, 2026

  Forge 0.5.0 released

  Forge now has a search engine of its own. forge-search is a new workspace crate — fetch, extract, index, rank — written without dependencies, so the HTML parsing, tokenising, on-disk index and ranking are all in the open and the engine can be lifted out whole. It reaches the corpus already on disk through a new search_documents tool, and the biomedical literature through search_papers, which uses PubMed Central's published API because that site's robots.txt forbids crawling it.

  Much of the rest of the release is the tool being made to stop overstating what it knows. A bot check on robots.txt was being read as permission: Cloudflare answers some hosts with status 418 and the real file in the body, 418 counted as permanently gone, so rules reading Disallow: / were discarded as absent and a site that forbids crawling was crawled. Being handed a single page by a person no longer makes a whole host count as read. Coverage is weighted by how rare each query word is, so a section matching only how, does and the stops reporting 0.75 and looking like a close call. And a result now names the query words the index has never seen, because a query whose subject is absent still matches on its grammar and every number attached to it is then truthful and useless. The tool's own description was rewritten too: it is a crawler with a library, not a search engine, and saying otherwise got it called wrongly and then blamed.

  The index became a directory of append-only segments rather than one file rewritten on every save. At the fifty-thousand page cap the old shape wrote 556 MB to add sixty pages; a crawler saving each batch would have written on the order of 35 TB a day against a consumer SSD rated for 300–600 TB in total. Pages a bot check refuses can be opened by a person and handed back to the agent, and the editor gained a browser tab for exactly that — deliberately narrowed to that job after it had grown an address bar and a library an editor does not need. Signed build attached to the release. See the 0.5.0 release notes.

• September 14, 2026

  Forge 0.4.2 released

  A .gz file now opens in the editor, decompressed by the same DEFLATE implementation written for the PNG decoder in 0.4.0 — a different header over the same payload, so it cost a header parse and no new dependency, and the trailer's checksum and length are both verified. Anything that genuinely is not text now says so plainly instead of reporting a UTF-8 decoding fault. A saved agent conversation no longer stores whole tool results: one here had reached 11.4 MB on the strength of a single 7.4 MB result, and since the transcript is rewritten in full on every new message that was eleven megabytes re-serialised each time on the event-loop thread. Saved output is capped at 64 KB keeping both ends, with the untruncated copy remaining in the agent's own log, which is what rewind reads — the largest conversation drops to 3.4 MB and all thirty-five fall 27% in total. The agent composer grows with what is typed rather than scrolling inside three fixed lines, and the send button turns red, shows a stop square, and interrupts the turn while one is running, instead of sitting inert for its duration. Editor tabs also gained a right-click menu for copying paths. Multi-cursor edits are undoable. Signed build attached to the release. See the 0.4.2 release notes.

• September 13, 2026

  Forge 0.4.1 released

  Three memory and correctness fixes in the editor. An undo step used to be a copy of the whole buffer, so an eighteen-thousand-line file held roughly 136 MB of undo history; a step is now the one region of lines that differs, measured at 25 KB for two hundred steps on a 1.1 MB file against 215 MB as whole copies. Undo depth became a setting rather than a constant. Terminal scrollback in a saved session stored a colour beside every single character; it is now text plus the runs of colour over it, which took real saved sessions from 12.3 MB to 0.5 MB with nothing dropped — every character keeps its own colours, described once per run instead of once per character, and sessions written by earlier builds still load. And Restart Window now carries a window's identity even when the shared window record has no entry for it; previously the window came back apparently new while a megabyte of its saved state sat on disk under the old id. Windows are also planned one at a time, so a single missing entry no longer sends every window down the folder-only path. Signed build attached to the release. See the 0.4.1 release notes.

• September 10, 2026

  Forge IDE is available as a signed build

  A signed and notarized .dmg is attached to the 0.4.0 release, so installing the IDE no longer means building it. It carries a Developer ID signature, the hardened runtime, and a stapled notarization ticket — which means it installs without a Gatekeeper prompt and without needing to reach Apple at first launch. The build is arm64 and requires macOS 13 or later; the bundled forge-agent and forge-server binaries are signed individually as well. Distribution testing on a .dmg had been noted as beginning in July and is what this closes.

• September 7, 2026

  Forge 0.4.0 released

  The IDE now decodes images itself rather than through the image crate — DEFLATE and zlib, PNG across all five colour types and bit depths 1 through 16 including Adam7 interlacing, and GIF89a including LZW and all four frame-disposal methods, in about a thousand lines, decode-only. Output was compared byte for byte against the crate it replaces over a 25-megabyte image before that crate was removed; six crates left the dependency graph. The agent gained a working area of its own under the system temporary directory, so scratch scripts and one-off reproductions stop landing in the user's project — auto-approved writes are confined to it by resolved-path comparison rather than string prefix, the directory is created 0700, and one that is a symlink or owned by another user is refused. A conversation driven far past the context limit can now recover instead of wedging permanently, and single tool results are bounded as they arrive so the recovery path is a backstop rather than what keeps a session alive. The terminal client rewrites only the transcript lines that changed instead of reprinting the whole live block on every spinner tick, which had been sustaining 11.2 KB/s of escape sequences for the length of a run. Full detail in the 0.4.0 release notes and the per-component changelogs.

• August 28, 2026

  Forge 0.3.1 released

  A same-day patch on 0.3.0, carrying two fixes. A session title was cut to length by byte index rather than character boundary, so any multi-byte character landing on the cut point panicked the agent's runtime thread — an emoji in a prompt, a CJK identifier, an accented word, or the box-drawing characters models reach for when sketching a diagram. The same pattern was present in seven places across the agent and the editor; all seven now cut on character boundaries and count their limits in characters, with a property test walking every cut point of a mixed ASCII/emoji/CJK string. Separately, an editor window with no folder open named the home directory in its status bar — which is the account name, so it placed the user's name in the corner of every screenshot of an empty window. It now reads No folder. See the 0.3.1 release notes.

• August 28, 2026

  Forge 0.3.0 released — IDE and CLI ship together

  Forge 0.3.0 is publicly available. The Forge IDE joins the terminal client as a second, independent surface; both run against the same forge-agent binary. The repository is now a Cargo workspace at github.com/Vulkgryph/Forge, carrying forge-agent, forge-tui-rs, and forge-ide. macOS on Apple Silicon is the verified platform; Linux x86-64 builds and passes tests in CI, and Linux ARM64, Windows, and Intel Macs are intended but not yet end-to-end smoke-tested. See the 0.3.0 release notes for the full component breakdown and the per-component CHANGELOGs.

• August 27, 2026

  Repository temporarily private — Forge IDE release preparation

  The Forge repository has been set to private while the Forge IDE is prepared for release and undergoes internal review. The CLI's public source is unchanged in substance — both surfaces will re-emerge together as a monorepo at the same URL when the IDE release is ready. Existing installs continue to work; new clones and forge-update pause during this window. The v0.1.0, v0.2.0, and v0.2.1 release tags remain in the repository history for the moment of re-release.

• July 20, 2026

  Forge IDE reaches 0.1.0 code stability

  The IDE is now stable enough to be used as the primary editor in production work on the maintainer's own flow. Reliability across all flows is not yet fully established — expected for a first release — but the core loop is solid. Distribution testing on the signed .dmg begins now; public release follows when that testing passes.

• July 1, 2026

  Forge 0.2.1 released

  Reliability release. Ends the edit_file "old_string not found" loop by returning bounded recovery hints (closest match, whitespace diffs, or a disambiguation list) instead of a bare error — especially valuable for weaker local models. Restores token counting on streaming OpenAI-compatible endpoints (mlx_lm, vLLM, llama.cpp, LM Studio, OpenAI), which had been silently breaking auto-compaction on long local sessions. Recovers tool calls that misbehaving servers leak as raw text so the agent no longer stalls at high context on mlx_lm. Installer now checks for curl, ripgrep, and bun up front. See the CHANGELOG.

• June 25, 2026

  Forge 0.2.0 released

  0.2.0 ships streaming reasoning display for chain-of-thought models (compact "Thinking…" line with Ctrl+T to expand), fixes compatibility with strict OpenAI-compatible servers like mlx_lm that require the system message first, and corrects a Ctrl-key shortcut leak into the input field. It also formally completes the Claude subscription OAuth removal first patched into 0.1.0 — Anthropic is still fully supported via API key. See the CHANGELOG for details.

• June 19, 2026

  Forge 0.1.0 released

  Forge is now publicly available. Source is on GitHub at github.com/Vulkgryph/Forge under the Vulkgryph organization. Installation, configuration, and usage notes live in the repository README. Reach contact@vulkgryph.com for inquiries.

• June 16, 2026

  Project page expanded

  Forge's project page now describes the agent's capability surface ahead of the public release push. Repository and documentation links remain pending until the public push lands.

• June 1, 2026

  Project page established

  Forge now has a project page and Git-backed project log source. Detailed changelogs can remain in the repository when public.

Documents

• Repository github.com/Vulkgryph/Forge
• Latest release 0.6.0 — 2026-09-29
• Download (IDE)

  Forge-IDE-0.6.0.dmg — signed and notarized, Apple Silicon, macOS 13 or later. The terminal client is installed from source; see the README.

• Documentation README on GitHub
• Inquiries contact@vulkgryph.com